Attack Detection Device, Attack Detection System, Attack Detection Method, and Attack Detection Program

Abstract

An attack detection device detects a cyber attack in a mobile network that includes a RAN including RAN communication devices that perform wireless communication with a user terminal. The attack detection device includes an information integration unit and an attack detection unit. The information integration unit acquires pieces of resource information of the RAN communication devices and integrates the pieces of resource information. The attack detection unit detects the cyber attack based on the integrated pieces of resource information.

1 . An attack detection device that detects a cyber attack in a mobile network including a radio access network comprising a plurality of first communication devices that include a first processor and perform wireless communication with a user terminal, the attack detection device comprising:
 a second processor, wherein   the second processor is configured to:
 acquire pieces of resource information of the plurality of first communication devices and integrate the pieces of resource information; and 
 an attack detection unit configured to detect the cyber attack based on the integrated pieces of resource information. 
   
     
     
         2 . The attack detection device according to  claim 1 , wherein
 the mobile network includes a core network including a second communication device that includes a third processor, controls wireless communication in the radio access network, and relays data between the radio access network and an external network, and   the second processor is configured to integrate the pieces of resource information by associating control information of the wireless communication acquired from the core network with the pieces of resource information of the plurality of first communication devices.   
     
     
         3 . The attack detection device according to  claim 1 , wherein
 the mobile network includes a core network including a second communication device that includes a third processor, controls wireless communication between the user terminal and the first communication device, and relays data between the radio access network and an external network,   the second processor is configured to control a controller of the radio access network to make the controller execute analysis processing of analyzing communication data of the first communication device when an abnormality is detected in resource information of the second communication device, and   the second processor is configured to detect the cyber attack based on a result of the analysis processing.   
     
     
         4 . The attack detection device according to  claim 1 , wherein
 the second processor is configured to: share information regarding the cyber attack detected by the attack detection unit with a controller of the radio access network; and control the controller of the radio access network to make the controller handle the cyber attack.   
     
     
         5 . An attack detection system that detects a cyber attack in a mobile network including a radio access network and a core network, the radio access network including a first communication device that includes a first processor and performs wireless communication with a user terminal, and the core network including a second communication device that includes a third processor, controls the wireless communication in the radio access network, and relays data between the radio access network and an external network, the attack detection system comprising:
 an attack detection device including a second processor;   a first controller configured to manage the radio access network; and   a second controller configured to manage the core network, wherein   the second processor is configured to:   output a request for analysis processing of analyzing communication data of the first communication device to the first controller when an abnormality is detected in resource information of the second communication device acquired from the second controller; and   detect the cyber attack based on a result of the analysis processing.   
     
     
         6 . The attack detection system according to  claim 5 , wherein the first controller includes:
 a security analysis device configured to be activated in response to the request for analysis processing and execute the analysis processing; and   a hardware accelerator configured to execute transfer processing of transferring the communication data from the first communication device to the security analysis device and execute a part of the analysis processing offloaded from the security analysis device.   
     
     
         7 . An attack detection method of an attack detection device that detects a cyber attack in a mobile network including a radio access network, the radio access network including a plurality of first communication devices that include a first processor and perform wireless communication with a user terminal, wherein
 the attack detection method includes:   information integration processing of acquiring pieces of resource information of the plurality of first communication devices and integrating the pieces of resource information, and   detecting the cyber attack based on the integrated pieces of resource information.   
     
     
         8 . A non-transitory storage medium storing an attack detection program for causing a computer to function as the attack detection device according to  claim 1 .